CVE-2025-66506
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Fulcio prior to 1.8.3 contains a vulnerability in the identity.extractIssuerURL function, which splits its untrusted argument on periods. A malicious request with an invalid OIDC identity token containing many period characters causes allocations of O(n) bytes, where n is the argument length, with a constant factor of about 16.
Risk Assessment
An attacker can trigger excessive memory consumption through malicious requests, potentially leading to resource exhaustion and denial of service.
Recommendation
Update Fulcio to version 1.8.3 or later, which fixes this vulnerability.
Other vulnerabilities in Fulcio
See all- CVE-2026-22772Medium
Prior to 1.8.5, Fulcio's metaRegex() function uses an unanchored regex, allowing attackers to bypass MetaIssuer URL validation and trigger SSRF to arbitrary internal services. The SSRF can only trigger GET requests, cannot mutate state, and the response is not returned, so only blind SSRF is possible.
- CVE-2026-49478High
Fulcio, a certificate authority for issuing code signing certificates for OIDC identities, versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind SSRF, substitute and cache malicious JWKS keys, or disclose ServiceAccount tokens to external hosts.
Original NVD description (English source)
Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to extractIssuerURL incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This vulnerability is fixed in 1.8.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS